Classification and Explanation of Distributed Denial-of-Service (DDoS) Attack Detection using Machine Learning and Shapley Additive Explanation (SHAP) Methods

Explainability is critical for trustworthy cybersecurity AI: The paper emphasizes that machine learning models used to detect DDoS attacks need more than just accuracy—they require transparent explanations of their decisions. Using SHAP (Shapley Additive Explanation) methods helps security teams understand why a model flagged traffic as malicious, increasing confidence in the system's trustworthiness.

Feature selection improves model efficiency without sacrificing performance: The researchers reduced their model inputs from all available features down to the top 20 most important features using XAI-based techniques. This streamlining makes the model faster and easier to interpret while maintaining classification effectiveness—a practical benefit for real-world deployment.

Distinguishing legitimate from malicious traffic remains genuinely difficult: The paper identifies that separating normal network traffic from DDoS attacks is "a challenging task," highlighting why automated AI solutions are necessary but also why their decisions need to be explainable to human operators who must act on them.

Combining machine learning with explanation methods creates a more responsible approach: Rather than treating classification and explanation as separate steps, the proposed framework integrates them together. This design philosophy—building interpretability into the system from the start rather than adding it later—represents a best practice for responsible AI in cybersecurity applications.